CVE-2021-24635
Assigner: WPScan
Published: 2021-09-20T10:06:38
State: PUBLISHED
affected: product: Visual Link Preview
vendor: Unknown
versions: lessThan: 2.2.3
status: affected
version: 2.2.3
versionType: custom
credits: value: apple502j
descriptions: value: The Visual Link Preview WordPress plugin before 2.2.3 does not enforce authorisation on several AJAX actions and has the CSRF nonce displayed for all authenticated users, allowing any authenticated user (such as subscriber) to call them and 1) Get and search through title and content of Draft post, 2) Get title of a password-protected post as well as 3) Upload an image from an URL
problemTypes: descriptions: cweId: CWE-284
description: CWE-284 Improper Access Control
type: CWE
source: discovery: UNKNOWN
title: Visual Link Preview < 2.2.3 - Unauthorised AJAX Calls
x_generator: WPScan CVE Generator